Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
3
Impact
~11k people reached

  • 0 posts edited
  • 0 helpful flags
  • 6 votes cast
Jan
21
comment How can I verify SSL certificates on the command line?
One further caveat: If you use -CApath nosuchdir then the combination of server.crt and cacert.pem must include the root CA; if openssl can only work up to an intermediate CA with those files then it will complain.
Jan
21
comment How can I verify SSL certificates on the command line?
No problem, glad to help. :-) One caveat that I figured out after posting my earlier comment: if the file specified with -CAfile is itself just an intermediate certificate, then openssl will complain. This is correct behavior, since verify requires a complete chain all the way up to a root CA, but can be misleading.
Jan
20
comment How can I verify SSL certificates on the command line?
Warning, the -CAfile option is more permissive than you might expect. See my comment on the accepted answer for details.
Jan
20
comment How can I verify SSL certificates on the command line?
Warning, the openssl verify command is more permissive than you might expect! By default, in addition to checking the given CAfile, it also checks for any matching CAs in the system's certs directory e.g. /etc/ssl/certs. To prevent this behavior and make sure you're checking against your particular CA cert given by CAfile, you must also pass a -CApath option with a non-existant directory, e.g.: openssl verify -verbose -CApath nosuchdir -CAfile cacert.pem server.crt
Apr
17
awarded  Autobiographer
Dec
16
awarded  Teacher
Dec
16
answered Root access that can't change root password?
Mar
27
awarded  Supporter